TLS certificate issue

[chiache11]

I tried to add ca certificate to verify TLS connection, but I didn't find any parameter to use.
Does TLS use insecure way to establish the connection?

I also tried the different command for -EnableGNMIServer parameter, but both of them can work with TLS connection.(I didn't use parameter NoTLSVerify)
What is the different from these two command output ?

./gnmi-gateway -EnableGNMIServer -ServerTLSCert=cacrt.pem -ServerTLSKey=cakey.pem -Exporters debug -TargetLoaders=json -TargetJSONFile=targets.json

./gnmi-gateway -Exporters debug -TargetLoaders=json -TargetJSONFile=targets.json

Is this todo parameter for mutual authenticate?

// ClientTLSConfig are the gNMI client TLS credentials. Setting this will enable client TLS.	
// TODO (cmcintosh): Add options to set client certificates by path (i.e. like the server TLS creds).
ClientTLSConfig *tls.Config `ignored:"true"`

[colinmcintosh]

Hi @chiache11, that TODO item is related to the client TLS settings but probably includes a few things including the CA certificate that the client uses to validate the cert the server provides. The plan is to add command-line parameters for this but it's not something that is completed yet. In the meantime you can start-up the server from a .go file where you can pass in the client TLS credentials and CA certs. Take a look at the Main function here for an example of how to do that startup. You can pass the TLS. Before doing that startup you can set ClientTLSConfig on GatewayConfig to pass in your client TLS creds.